What Caused Outbound Traffic from a Web Server with Image Uploads?
A company web server is initiating outbound traffic to a low-reputation, public IP on non-standard pat. The web server is used to present an unauthenticated page to clients who upload images the company. An analyst notices a suspicious process running on the server hat was not created by the company development team. Which of the following is the most likely explanation for his security incident?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests recognition of web shell attack vectors: file upload functionality can be abused to deploy a server-side script that gives attackers remote control, causing suspicious processes and non-standard port C2 traffic.
A web server with an unauthenticated image upload page is compromised when attackers upload a web shell, leading to a suspicious process and outbound traffic to a low-reputation IP. Community consensus confirms option A (web shell deployed through the page) as the most likely explanation.
Choosing D (rootkit Trojan via exposed RDP) is a common mistake because the non-standard port and remote control indicators look like RDP exploitation, but the scenario gives no evidence of RDP exposure and clearly points to the image upload page as the entry vector.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The web server hosts an unauthenticated image upload page, which is a classic vector for deploying web shells. The suspected process running on the server was not created by the development team and outbound traffic is going to a low-reputation IP on a non-standard port — these are typical indicators of a web shell connecting back to an attacker-controlled command-and-control server. Option A directly ties the shell's deployment to the vulnerable upload page, matching the incident chain.
Why the Other Options Are Wrong
Option B (worm) is unlikely because a worm self-propagates across networks without needing a specific upload vector; this scenario describes a single compromised server with an obvious entry point. Option C (cryptocurrency mining) could explain outbound traffic, but mining would more likely show high CPU usage and doesn't explain the unauthorized process as the root cause; the web shell is the more precise and likely initial compromise. Option D (rootkit Trojan via RDP) is tempting because of the non-standard port, but no RDP exposure is mentioned, and the image upload page is the only clear attack surface — while a rootkit could be a later stage, it is not the most likely explanation for the initial incident.
Community Comment Notes
Comment 1 (7 likes) correctly states that a web shell allows unauthorized access and control, aligning with the observed traffic and process. Comment 2 (1 like) emphasizes that the uploaded image file itself is a web shell, directly confirming the upload vector. The highest-voted comment (22 likes) criticizes the phrasing as poorly worded but still identifies option A as the intended answer, which supports the consensus.
Official Reference
Exam Strategy
When a question describes an unauthenticated web page that allows file uploads, immediately suspect a web shell even if the file is an image—check for file type validation and server-side script execution. On the exam, link the upload entry point to the indicators of command-and-control traffic to rule out other attack vectors.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →